Authenticated name resolution

ABSTRACT

A method, system, and computer-readable memory containing instructions include receiving a DNS request containing authentication information, validating the authentication information, determining an appropriate action to take based on the validating status, and taking the appropriate action. Actions may include responding with an individualized network layer address or service location address, delaying sending a response message, sending a network layer address or service location address corresponding to a site containing authentication information, and sending a response with a network layer address or service location address with a web address configured to mimic the website related to the requested resource.

TECHNICAL FIELD

This disclosure generally relates to Domain Name Service (DNS)resolution. In particular, this disclosure relates to methods andsystems for authenticating DNS resolution requests and providingauthentication dependent responses.

BACKGROUND

The DNS system utilizes a hierarchical structure to associate fullyqualified domain names to a particular IP address in response to a DNSquery. For example, if a user visits the website www.example.com ontheir computer's Internet browser, typically, the stub resolver on thecomputer would (1) first check its own DNS cache for a suitableresponse; (2) if not available in cache, query a recursive name serveror possibly each level of the delegation graph from the root DNS serverdownward with the same information, expecting a reply. If the queriedsystem has the information or is authoritative for the precise question,it provides a response or error. If it does not but knows who is, itprovides a delegation/referral to the child that should have moreprecise information. To leverage larger caching mechanisms, a DNSresolver (recursive name server) may be used between steps (1) and (2).Because a DNS resolver services many users, it typically holds a largercache, helping to reduce the load on root servers and registry serversand often minimize response times for users because it is commonlytopologically closer to the client. A DNS resolver may also act as arecursive name server, handling the multiple transactions and followingdelegations/referral chains between different name servers to resolvethe final IP address for the resource in question, simply passing thefinal answer back to the user's computer. A DNS resolver may ultimatelyprovide in its response a network layer identifier or service locationid, which in some instances may be the same.

Some DNS servers support basic filtering of DNS queries based on thesource IP address of the original querying machine. For example, someservers may compare the source IP address to whitelists or blacklists ofIP addresses and allow or disallow the IP address accordingly. Otherservers may use the source IP address to approximate the location(geolocation) of the query source machine, and use this locationinformation to customize the response by returning an IP address of aresource server that is thought to be closer in proximity than another.In all of these cases, generally, once the response is allowed, the DNSresponse returns the IP address (or network layer identifier or servicelocation id) of a machine that will provide access to the resourceserver. This IP address, the network layer identifier and servicelocation id, is resolved regardless of the status of the user'spermission to ultimately use the resource.

For example, suppose a user visited a web site with a customized portalon it, such as mypage.example.com. If the user does not have a validaccount with mypage.example.com, allowing the user to access the site atall may be unnecessary and poses a potential security risk throughdisclosure of the network layer identifier and locator for the resource.Even if the user does have an account with mypage.example.com, somemechanism must still be employed for the user to be identified andauthenticated by the website.

Various means exist to authenticate a user that is requesting aresource. In a typical scenario, the user may have login credentials ona website, or a cookie associated with past exchanges of thosecredentials. The login credentials, once validated, authenticate theuser, allowing access to member only or user specific resources. Forexample, a user visiting a bank's website may login to view informationassociated with the user's account.

One problem with this type of authentication is that, until the user isauthenticated or identified, the resource resolution process typicallyacts in the same way for every user. Advanced networking mechanisms maybe employed on the resource server to filter different types of requestsbefore authentication, such as diverting network traffic based on thegeolocation of a user's IP address, e.g., a user in Europe may bediverted to a server based in Europe.

Alone, these techniques are problematic for several reasons. One problemwith these techniques is that in every instance the resource IP address(or the network layer identifier and service location identifier) isexposed. This is undesirable because the disclosed nature of theresolved IP address (or network layer identifier or service locationidentifier) exposes the resource to distributed denial of service (DDoS)attacks, probes of the software of the systems associated with the IPaddress for security weaknesses, or attempts to gain unauthorized accessor control of user accounts or other resources normally accessed at thatIP address (or network layer identifier or service location identifier).This situation is akin to, after receiving a knock on the front door,opening the door just a crack to see who is outside. If the personoutside is malicious, once you open the door, the person may be able toget it in. It would be safer to verify who is standing outside beforeopening the door, or perhaps not to disclose your home address and whatresources may be available there in the first place.

A method and system is desired that can perform authentication of a DNSrequestor prior to returning an IP address (or network layer identifieror service location identifier), to in part ensure that the requestorhas authorization to access to the ultimate resource before opening thedoor or disclosing the address. The following disclosure solves theseproblems and provides added conveniences and functionality to the nameresolution process. For example, as described below, thispre-authentication system allows administrators to prescribe specializedbehavior at the DNS level based on the authentication status of therequestor.

SUMMARY

A method, system, and computer-readable memory containing instructionsinclude receiving a DNS request containing authentication information,validating the authentication information, determining an appropriateaction to take based on the validating status, and taking theappropriate action. Actions may include responding with anindividualized network layer identifier or service location identifier(such as an IPv4 or IPv6 network layer address), delaying sending aresponse message, sending an IP address (or network layer identifier orservice location identifier) corresponding to a site containingauthentication information, and sending a response with an IP address(or network layer identifier or service location identifier)corresponding to a web address configured to mimic the website relatedto the requested resource.

In an embodiment, the authentication information is added to the DNSresolution request by a device other than a device that originates theDNS resolution request. In some embodiments, authentication informationincludes one or more of: a source IP address, a username/passwordcombination, an encrypted data package, and hardware identificationinformation.

In some embodiments, authentication information is received from aresource server and the information is updated in the authenticating DNSserver. In some embodiments the individualized network layer identifieror service location identifier may correspond to a one-time-useidentifier or an identifier that is normally dedicated to a particularuser.

In some embodiments, where identification information determines thatthe requestor has previously been denied access to the resource serverIP address, the network layer identifier or service location identifier,and received a delayed response, subsequent DNS requests receive longerand longer delays before processing. In some embodiments, theauthenticated user is classified into a class and, depending on theclass, receives prioritized access to the resource server.

In some embodiments, a community authority trust may issue anauthentication certificate confirming the identity of a user requestingthe name resolution of a domain name. A user may use the authenticationcertificate to make the name resolution request. Once validated, theauthentication certificate may be used by the authenticating DNS serverto determine an IP address (or network layer identifier or servicelocation identifier) to provide in response to the request.

In some embodiments, the DNS request and identification information maybe logged along with the DNS response or other action taken. These logsmay be analyzed for statistical data trends in requests and responses.The logs may also be analyzed to determine security trends among varioussource IP addresses, e.g., for identifying IP addresses or users thatshould be blacklisted.

In some embodiments, the outcome of the validation of the authenticationinformation may be used to create billing information, enabling aservice operator to bill a client for certain types of responses.

It is to be understood that both the foregoing general description andthe following detailed description are exemplary and explanatory onlyand are not restrictive of the application, as claimed.

The accompanying drawings, which are incorporated in and constitute apart of this specification, illustrate embodiments of the applicationand together with the description, serve to explain the principles ofthe application.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 illustrates an exemplary architecture demonstrating componentsthat may be used to implement an authenticated resolution platform;

FIG. 2 illustrates an exemplary process of receiving a DNS request,authenticating it, and returning a response;

FIG. 3 illustrates an exemplary process of validating authenticationinformation supplied in a DNS request;

FIG. 4 illustrates an exemplary process of classifying a user based onauthentication information;

FIG. 5 illustrates an exemplary process of using IPv6 addresses in a DNSresponse based on user authentication;

FIG. 6 illustrates an exemplary process of providing a security responsebased on missing, unexpected, or invalid authentication information;

FIG. 7 illustrates an exemplary architecture demonstrating componentsthat may be used to implement an authenticated resolution platformincluding a community trust authority; and

FIG. 8 illustrates an exemplary process of using an authenticationcertificate obtained from a community trust authority to request anauthenticated name resolution.

DETAILED DESCRIPTION

Reference will now be made in detail to the exemplary embodiments.Wherever possible, the same reference numbers will be used throughoutthe drawings to refer to the same or like parts.

FIG. 1 illustrates an exemplary architecture (100) demonstratingcomponents that may be used to implement an authenticated resolutionplatform. A user's computer (105) may instigate a DNS request. Thisrequest may be sent because the user visits a website, a program runningon the user's computer initiates an online transaction, or any otherpossible reason that a user's computer would have the need to translatea fully qualified domain name, such as www.example.com, into itscorresponding IP address. To begin the request, the user's computer(105) retrieves the name server information for the top level domain(TLD), e.g. “com,” through a referral response from a root server (110).The root server (110) returns the response with the name server for theTLD (115). The user's computer (105) next queries the name server forthe TLD (115) for the fully qualified domain name information for thedomain, e.g., “example”, and again receives a referral to thesecond-level domain authoritative name servers. The authoritative nameserver is the authenticating name server (120). In this example, theauthenticating name server is authoritative to answer for the“www.example.com” fully qualified domain name and resolve it to therespective network layer address or service location address.

The authenticating name server (120) may have access to a localizedcaching system (125) to store both authentication information receivedfrom the user's computer (105), and authentication information receivedfrom the resource authentication interface (135), in a data store (130).The authenticating name server (120) interfaces with a resourceauthentication interface (135) to pass authentication credentials fromthe user's computer (105) to the resource authentication interface (135)and to receive a response with information regarding the authenticationstatus of the user.

The resource authentication interface (135) may also interface with theresource server (140). For example, the resource server for the websiteaddress http://www.example.com would be the server configured to respondto http requests for www.example.com at one or more IP addresses. If theuser's computer (105) is authenticated, then the authenticating DNSserver (120) may return an IP address (or network layer identifier orservice location identifier) to the resource server (140) to the user'scomputer (105). Then the user's computer may access the resource serverby the given IP address.

One skilled in the art will appreciate that the architecture of FIG. 1is merely exemplary. Other networking devices may be incorporated tomanage traffic. In particular, one skilled in the art would recognizethat firewalls, load balancers, additional mirrored servers (nameserver, resource server, and authentication interfaces), and certainname server caches may be incorporated into the network design andarchitecture. Further, one skilled in the art will recognize thatadditional hierarchical DNS servers may be queried, e.g.,secure.www.example.com, and that interfaces and servers may be combinedto be on one physical machine. For example, the resource authenticationinterface (135) may be physically and programmatically collocated on thesame machine or machines as the resource server (140).

Further, although a DNS server on the Internet traditionally operates asreturning an IP address, this function can be localized at higher IPlayers for dedicated networks. For example a DNS server that returns anetwork layer identifier and a service location identifier mayessentially be returning an IP address corresponding to a machine.However, a DNS server may also be understood to return a network layeridentifier and service location identifier in the terms of a UniformResource Identifier (URI), identifying a particular layer and servicelocation. One of ordinary skill in the art will appreciate that anymention of returning an IP address alone in this disclosure should beunderstood to alternatively and additionally include the possibility ofdistinguishing between an network layer identifier or service locationidentifier.

The authenticating DNS server (120) may interface with a security policyengine (not shown), either external or internal to the network. Thesecurity policy engine may inform authenticated resolution functions atthe authenticating DNS server (120) or any other networking device thatis designed to make use of security policies. An exemplary architectureillustrating such a use of a security policy engine as a community-basedpolicy trust is described below in conjunction with FIG. 7.

Turning back to the authenticating DNS server (120), the authenticatingDNS server (120) may be implemented in software as software modules orprograms on one or more computing systems. For example, thefunctionality of the authenticating DNS server (120) may comprise one ormore applications, which may comprise one or more computer units ofcomputer-readable instructions which, when executed by a processor,cause one or more computers to perform steps of a method. In particular,the exemplary architecture in FIG. 1. may support execution of programcode on one or more computers to accomplish the overall method.Computer-readable instructions may be stored on a computer-readablemedium, such as a memory or disk. Such media typically providenon-transitory storage. One or more of the components depicted inFIG. 1. may be hardware components or combinations of hardware andsoftware such as, for example, special purpose computers or generalpurpose computers. A computer or computer system may also comprise aninternal or external database. The database may comprise one or moreindividual databases or databases configured to act together. Thedatabase may be implemented in a commercial, open source, or proprietarydatabase program or may be contained in log files, flat files, or anyother data storage mechanism. The components of a computer or computersystem may, among other things, connect through a local bus interface orover a local or wide area network. The components depicted in FIG. 1 maybe operatively connected to one another via a network, not shown, suchas the Internet, an intranet, or any type of wired or wirelesscommunication system. Connections may be implemented through a directcommunication link, a local area network (LAN), a wide area network(WAN) and/or other suitable connections.

FIG. 2 illustrates an exemplary process (200) of receiving a DNSrequest, authenticating it, and returning a response. In step 210, theauthenticating DNS server (120) receives a domain name resolutionrequest for a domain name. As discussed above, the authenticating DNSserver (120) is authoritative to respond for that domain name. Theauthenticating DNS server (120) examines the DNS request and determinesthat the request requires authentication in step 220. In particular, theauthenticating DNS server (120) may be a multipurpose DNS server, actingboth as an authenticating DNS server and a normal authoritative server.Thus, determining that the DNS request requires authentication allowsthe remaining steps of authenticating the request to proceed. If, ingeneral operation, the DNS request did not require authentication, thennormal DNS responding techniques would commence.

In step 230, the process may consider whether the DNS request containsauthentication information. If it does, the process may consider, instep 240, whether the authentication information matches the expectedformat and type of authentication information. If the authentication isin the proper format and type, the process will consider, in step 250,whether the authentication information is valid. If in any of theprevious steps, the DNS request did not contain authenticationinformation, it was present but in the wrong format or type ofinformation, or if the authentication process was invalid, then anappropriate security action or response may be determined in step 270.The security action or response step will be discussed in more detailbelow. One skilled in the art will appreciate that steps 230 and 240, inparticular, are optional and interchangeable, and are presented todemonstrate a means of culling out DNS requests before presenting themto be authenticated in a validation process. Other traffic managementtechniques may also be applied, such as whitelisting/blacklistingtechniques and other such traffic management techniques according toknown or yet to be discovered traffic management techniques.

If the DNS request is authenticated, the authenticated user or requestormay be classified into a particular class of user as in step 260. Morewill be discussed about classifications below. As noted in FIG. 2, step260 is also optional. A response to the DNS request is returned to theuser's computer (105) in step 270. If any of the tests failed, resultingin an unauthenticated request, a security action and response isdetermined as in step 280.

FIG. 3 illustrates an exemplary process (300) of validatingauthentication information supplied in a DNS request corresponding to inexemplary step 250. The authentication information is examined in step310. The authentication cache (125) is examined to determine whether theuser has been recently authenticated in accordance with implementedcaching guidelines in step 320. If so, then the authentication cache mayvalidate the user as authenticated in step 350. If not, then theauthenticating DNS server (120) may query a resource authenticationinterface (135) to determine whether the authentication information isvalid as in step 330. If the resource authentication interface (135)returns valid in step 340, then the user is determined to beauthenticated. Otherwise, the user is determined to be unauthenticatedas in step 360.

Authentication information covers an entire gamut of information thatmay be supplied in the DNS request or detected from the DNS request.Attributes provided by the requesting user in the DNS request includesuch things as an IP address, MAC address, reputation data,username/password, encryption schemes, hardware keys, geolocationinformation, fingerprint identification, encrypted packages usingprivate/public key authentication schemes, machine hardware IDs, productor license IDs, security policy certificates, or any other imaginableuser-identifying information in the DNS query itself.

In one embodiment, authentication information may, instead ofauthenticating a particular user, authenticate a particular user asbelonging to a group. In another embodiment, authentication informationmay be inserted by a packet monitoring device after the DNS requestleaves the user's computer. For example, a corporate computer may send aDNS request which is then intercepted before leaving the corporatenetwork, and updated by inserting authentication information in therequest.

In another embodiment, the authentication information may be some datathat has been encrypted by a private key in a PKI infrastructure. Theauthenticating server would then decrypt the data using a previouslytransmitted public key corresponding to the user's private key.Verifying the data authenticates that the user that encrypted the datais the expected user. For example, the authenticating DNS server mayrecognize the source IP address of a particular user, but requirefurther proof through the above outlined PKI key pairencryption/decryption scheme. Further, the authenticating DNS server mayencrypt the DNS response using its own private key, having provided thepublic key to the user's computer.

One skilled in the art will appreciate that other combinations ofauthentication information may be included to provide one or moreindicia that the user's computer is the device it claims to be and thatthe user is allowed to receive a DNS response. Authenticationinformation may also show that the user's computer is being operated bya particular user, thereby actually authenticating the particular user.For example, authentication information can include informationpertaining to the identity of the user, such as name/passwordcombinations and the like.

FIG. 4 illustrates an exemplary optional process (400) of classifying auser based on authentication information corresponding to exemplary step260. In step 410 the process determines available classifications forthe particular resource requested. Exemplary classifications includesuch things as a “high,” “middle,” or “low” priority user; agovernmental user; an emergency professional user; a high-traffic user;a free user; a paid user; a premium user; a guest user; and so on. Auser may be classified into one or more of the available classificationsin step 420. In step 430, the classification of the user is tracked sothat the classification information may be used later in the process ofreturning a DNS response.

FIG. 5 illustrates an exemplary process (500) of using IPv6 addresses ina DNS response based on user authentication corresponding to exemplarystep 270. Because the IPv6 address space is so vast, in one embodiment,individualized IPv6 addresses may be returned as the DNS response.Whereas the traditional IP address space (IPv4) contains a total numberof theoretical addresses as 4,394,967,296 addresses, the number oftheoretical IPv6 addresses is 10²⁸ times larger. To be sure, over 4trillion IP addresses is a lot of addresses, but because of architecturelimitations, the actual number of available addresses is significantlyless. IPv6 addresses add so many available IP addresses, that eachperson on the earth could have almost 8 million trillion IP addresses.Authenticated DNS resolution is poised to take advantage of the large IPaddress space by utilizing individualized IPv6 responses. One skilled inthe art would understand that the exemplary embodiments described belowwith respect to IPv6 addresses could equally apply to any name tonetwork layer identifier or service location identifier resolutionprocesses.

Each DNS response may be individualized based on the user accessing theresource. For example, in one variation, the DNS service may return apermanently assigned IPv6 address corresponding to the user. The IPv6address may be unique to the user or may be shared amongst two or moreusers. In another variation, the authenticating DNS server may return atemporary IPv6 address that is only good for a particular length of timeor until activity to the IPv6 address times out after a period ofinactivity. Once the IPv6 is used, it may either never be used again, ormay be recycled to be used in the future. Using a permanent IPv6 orother network layer address has the advantage of creating more easilyfollowed logging of access to the resource. Other embodiments may applythese principles of a permanently or temporarily assigned IPv6 addressto both a network layer identifier or service location identifierindividually.

Turning back to FIG. 5, step 510 considers whether the response willissue a one-time-use (or seldom used) IPv6 (or network layer identifieror service location identifier) address or a previously assigned(permanent) address. If the process issues a one-time-use address, theauthenticating DNS server (120) will select a valid address to return asin step 520. The IP (or network layer identifier or service locationidentifier) address may be selected from a pool of available addressesor the resource authentication interface (135) or resource server (140)may be queried for an address to respond with. In step 530, theauthenticating DNS server (120) may notify the resource server (140) ofthe address assignment. Then the resource server (140) may provision theIP (or network layer identifier or service location identifier) addresson the machine.

If the process issues a previously assigned address, the process issimilar. The authenticating DNS server (120) will retrieve theappropriate IP (or network layer identifier or service locationidentifier) address either from its own authentication cache (125) ormay query the resource server (140) for an available address, as in step540. The previously assigned address may optionally be permanently (orsemi-permanently) assigned to a particular user. The determined IP (ornetwork layer identifier or service location identifier) address is thensent to the resource server (140) as in step 550 so that the resourceserver (140) can provision the IP address on the machine or machines.

One benefit of using individually assigned addresses is that apermanently assigned IP (or network layer identifier or service locationidentifier) address can be completely obscured from the public. Becauseonly assigned addresses to the resource server (140) are returned to theuser's computer, DDoS attacks to the resource server over an assignedaddress may be mitigated by simply deprovisioning (or unassigning) theaddress being attacked from the resource server (140).

When individualized IP (or network layer identifier or service locationidentifier) addresses are used in providing authenticated DNS responses,the resource server (140) may not need any additional authenticationschemes. For example, if the resource server (140) is a bank website,additional login credentials may be required, but if the resource server(140) requires less security, such as with a cloud based music service,ecommerce site, or customized portal, for example, then additionalauthentication may not be necessary. In this case, the resource servercould tell identity simply by recognizing which IP (or network layeridentifier or service location identifier) address was used in accessingthe resource. When a user stops using the resource server (140) for acertain period of time, on request (e.g., “logout”), or in response toanother set of circumstances, the resource server (140) may deprovisionthe IP (or network layer identifier or service location identifier)address.

In an embodiment, rather than provisioning a dedicated IP (or networklayer identifier or service location identifier) address on the resourceserver, the source IP address of an authenticated user may be added to awhitelist in a firewall placed between the resource server and useraccess. In this way, the firewall acts as a buffer to help protect theresource server from unwanted intrusion. Even if the IP address of theresource server becomes publicly known, exposing the IP address topotential DDoS attacks and the like, the firewall may block all trafficunless a specific security policy exists for a particular source IPaddress (or other identifying feature) of an authenticated user. Otherembodiments may combine the ability to dynamically set a security policyon a firewall and the ability to provision IP addresses or other networklayer addresses on a resource server.

One skilled in the art will appreciate that additional networkingdevices may be used in conjunction with the embodiments describedherein. For example, the architecture may also use a load balancer todistribute demand to a multitude of resource servers. In this case, anIP address may be provisioned on the load balancer along with a policydirecting which resource server to forward traffic to. The IP addressmay also be provisioned on the identified resource server. Othervariants of common networking architecture schemes incorporating theembodiments described herein would by apparent to one of ordinary skill.

In an embodiment that utilizes classification of authenticated userssuch as those tracked in step 430, classifications may be used to give auser a particular level of access. For example, members of a websitethat may be classified into “silver,” “gold,” and “platinum” members maybe given different levels of access simply based on the IP (or networklayer identifier or service location identifier) address that isaccessed. In a mobile phone network, mobile phones may be classifiedinto different priority classes corresponding to emergency personnel,government workers, first responders, and normal users. In a disasterarea, first responders and emergency personnel, for example, may begiven prioritized access to mobile networks to keep their communicationchannels open.

FIG. 6 illustrates an exemplary process (600), corresponding toexemplary step 280, of providing a security response or action based onmissing, unexpected, or invalid authentication information. In step 610,identification information is analyzed to determine if it is recognized.This identification information may be any information to assist inidentifying the user submitting the DNS resolution request, and mayinclude incorrect or invalid authentication information or a source IPaddress. If the identification information is recognized, the processmay determine if the user has previously been allowed access in step620. The authenticating DNS server (120) may query the resource server(140), data store (130), or another logging system where connectionshave been logged to determine whether the user has previously beenallowed access.

If the user was not recognized, the process may determine whether anyreasons exist to deny access based on the identification information asin step 630. For example, the process may compare the source IP addresswith known blacklists or perform a geolocation on the source IP address.If the IP address has been blacklisted, then the process may determineto deny access to the user. Or if the IP address geocodes to a countryor area not serviced by the resource server, then the process maydetermine to deny access to the user. A default policy may beimplemented to always deny unknown users pending further determinationas explained below. If no reason can be found to deny access, then theprocess may, in step 640, return an IP address corresponding to anidentifier and location where the user may obtain authenticationinstructions. For example, a user accessing www.example.com may beunrecognized, but the authentication system determines that the usershould be provided instructions on how to authenticate. In this case,the authenticating DNS server may respond with an IP address that servesa special version of the www.example.com website, constituting prominentauthentication instructions.

Turning back to step 620, if the identified user was previously deniedaccess, then the threat possibilities may be determined in step 650 andactions taken in step 660. If the identified user was previously allowedaccess, but for some reason the authentication information is invalid,the user may be directed to a specialized version of the requestedresource by a different IP address corresponding to authenticationinstructions as in step 640. Likewise, turning back to step 630, ifreasons were determined to deny access, such as when the source IPaddress was found on a blacklist, when the source IP address correspondsto a location not serviced by the resource server, or when a generalpolicy is in place to deny all unknown traffic, then the threatpossibilities associated with the DNS request may be determined in step650 and actions taken in step 660.

Step 650 may consider a number of threat possibilities. In the casewhere access was previously denied for a source IP address, suchbehavior may indicate that the source IP address (user's computer (110))is attempting to offer different forms of authentication information inorder to defeat the authentication scheme. In the case whereauthentication information is invalid, because one piece is ofinformation is different than expected, such behavior may indicate thata piece of equipment on the network has been taken over without theowner's permission. For example, if a source IP address is differentthan expected, but other authentication information is present, then themachine may have been stolen and connected to another network.

Based on the various threat possibilities, the process may takeappropriate action in step 660. Such action may include, simply notresponding; delaying the response and optionally increasing the delaywith each subsequent DNS query from the same IP address; responding withan alternative IP (or network layer identifier or service locationidentifier) address corresponding to a special version of the resource,corresponding to authentication instructions; responding with analternative IP (or network layer identifier or service locationidentifier) address corresponding to a special version of the resource,configured to look just like the resource; or responding with analternative IP (or network layer identifier or service locationidentifier) address corresponding to a special version of the resource,configured to provide an alternative means of authentication, whereinthe resource authentication interface may be updated as a result toallow further unhindered access.

For example, a user determined to be malicious may be served an IPaddress corresponding to a special version of the resource that looksand feels just like the true resource. The special version may collectdata about the malicious user, then terminate its connection with themalicious user and analyze the data. In another example, a user mayaccess a bank website from a particular IP address or machine for thefirst time. The bank may offer the user an alternative means ofauthentication, and, once authenticated, update the authenticationinformation in the store (130) or in the resource server (140).

As discussed above, some DNS servers will cache DNS responses from theauthenticating DNS server (120). Due to the integrity of theauthenticating DNS server, caching may be undesirable. One way toprevent caching is by setting the time-to-live (TTL) in the response to0, indicating that the response should not be cached. Another way toprevent caching is to encrypt the DNS response. The user's computercould have a public key corresponding to the authenticating DNS server's(120) private key. The authenticating DNS server may encrypt theresponse using the private key, which would be decrypted using thepublic key at the user's computer. Because the response would have beenencrypted, a caching DNS server could not cache the response, or wouldnot be able to resolve the ultimate response associated with the query.Caching corresponding to the root servers and TLD name servers (or otherservers in the delegation graph) could still be done. Anotheralternative way of maintaining integrity of the authentication status isto cache the DNS at an authentication aware caching server. A DNScaching server that is authentication aware, could perform a basic queryto the authenticating DNS server (120) or the resource authenticationinterface (135) to determine whether the authentication was still validprior to serving the response. If invalid, the cached response would beflushed and the request made to the authenticating DNS server (120),processed in accordance with the processes discussed above.

FIG. 7 illustrates an exemplary architecture (700) demonstratingcomputer and networking components of an authenticated resolutionplatform corresponding to an embodiment utilizing a federated trustmodel according to a community-based policy management system. Acommunity trust authority (705) may issue an authentication certificateto a user's computer (710) based on identification information providedwhen joining the community. Using the certificate as authenticationinformation, the user's computer may request a resource at a particularfully qualified domain name (or a local network name). The request maybe routed through an authentication aware network cache (715). The DNSresolution request may likewise be routed through an authenticatingcaching DNS sever (720). The caching server may then either pass theauthentication request from the user's computer (710) on to theauthenticating DNS server (730) or may compose a new set ofauthentication information to authenticate on behalf of the user'scomputer. If necessary, the caching DNS server may first query the rootserver (not shown) and registry DNS server (725) to obtain necessaryauthoritative nameserver information to locate the authenticating DNSserver (730). The authenticating DNS server may use an authenticationcache (735) and data store (740) to assist in the management ofauthentication. The authenticating DNS server (730) may connect to aresource authentication interface (745) if necessary to determinewhether the authentication information is valid. Notably, the resourceauthentication interface (745) may be attached to the resource server,attached (not shown) to the community trust authority (705), or attachedto both. Once authenticated, the authenticating DNS server (730) mayreturn the DNS response to the authenticating caching DNS server (720),which would, in turn, return the response to the user's computer (710).The user's computer may then request the resource from the resourceserver (750), the authentication aware network cache (715), or acombination of the two.

One skilled in the art will appreciate that the architecture of FIG. 7is merely exemplary. Other networking devices may be incorporated tomanage traffic. In particular, one skilled in the art would recognizethat firewalls, load balancers, additional mirrored servers (nameserver, resource server, and authentication interfaces), and certainname server caches may be incorporated into the network design andarchitecture. Further, one skilled in the art will recognize thatadditional hierarchical DNS servers may be queried, e.g.,secure.www.example.com, and that interfaces and servers may be combinedto be on one physical machine. Further still, one skilled in the artwill recognize that supporting hardware may also be incorporated intothe architecture, such as data stores and other memory devices.

FIG. 8 illustrates an exemplary process (800) of using authenticationcertificates in a federated network trust in an authenticating namerequest process. In step 810, the user is sends identificationinformation to a community trust authority (705) to request anauthentication certificate validating the identification information. Inan embodiment the authentication certificate may also containinformation regarding permissions associated with the authenticationcertificate. The community trust authority (705) may return theauthentication certificate to the user, as in step 820. One skilled inthe art will understand that the community trust authority (705) may bea server located within a closed network or a server located on theInternet, depending on the application of the community.

In step 830, a DNS request is sent by the user's computer to anauthenticating DNS server (730) using the issued authenticationcertificate. In step 840, the authenticating DNS server may seek tovalidate the authentication certificate. Generally, either theauthenticating DNS server will either recognize and trust thecertificate issuer or will not trust the certificate issuer. In step850, the authenticating DNS server (730) may determine whether theauthentication information is valid based on the trust status of thecertificate issuer and further based on a validation process of thecertificate. If valid (and trusted), the authentication certificate maybe used to deliver a user specific/class specific DNS response. In step860, the user may be classified into a group or class of recognizedusers. To do so, the authenticating DNS server (730) may query theresource authentication interface (745) if the authenticating DNS serverdoes not have classification information in its cache (735). In step870, an appropriate DNS response is returned and may be based on theidentification information contained within the authenticationcertificate. If the authentication certificate was not validated ortrusted, the authenticating DNS server (730) may determine anappropriate security response or action as in step 880.

One will appreciate that certain of the exemplary steps illustrated inprocess 800 parallel the exemplary steps illustrated in process 200.Thus, the specific exemplary processes found in FIGS. 3-6 may be appliedto the processes found in FIG. 8 as appropriate.

In another embodiment, the previously discussed embodiments may becombined with a process of capturing and logging the DNS requests andresponses based on the authentication result of the requestor. Asdiscussed above, the authenticating DNS server (120 or 730) may be ableto determine whether a response to a particular IP address was issuedbefore the handling of a current request, e.g., steps 610 and 620 ofprocess 600 found in FIG. 6. The authenticated DNS requests andresponses may be categorized and logged. For example, a DNS request mayinclude identification information which indicates that the requestor ison a blacklist. In this case, the request, identification information,and the corresponding appropriate DNS response (if any) may be logged.Likewise, a DNS request may include identification information which isvalidated, resulting in an appropriate DNS response. This informationmay also be logged. Indeed, all information corresponding to DNSrequests and responses may be logged. The logged information may beanalyzed for data trends pertaining to successful and unsuccessfulauthenticated DNS requests. For example, the logged information may beanalyzed to determine whether IP addresses should be blacklisted afterbeing repeatedly denied authentication, thereby improving efficiency ofthe overall authentication scheme.

A benefit of utilizing authenticated name resolution is that resolutionrequests may be categorized for billing purposes. For example, using thelogging information or via another logging process done in real time,each of the requests may be categorized into legitimate requests orattack requests. The client utilizing the authentication service maythen be billed according to one or both of those categories. Withoutauthenticated resolution, a nameserver typically has difficulty chargingon query volume because there is no way to know (or it would be toodifficult to determine) whether the owner of the resource authorized aname request. But with the authenticating resolution framework, namerequests may be billed both on volume authenticated as well as on avolume saved by denying a DNS response. For the volume authenticated,the billing may represent a volume portion of a fee to provideauthenticated name resolution services. For the volume saved, thebilling may represent a theoretical volume of traffic saved by hinderingaccess to the resource server by denying a name request. Of course,billing for either of these is optional. Additionally, other categoriesof authenticated response may be billed on. For example, name resolutionrequests that are diverted to a server describing how to authenticatemay be considered legitimate traffic and part of the authenticationvolume, even if the user is never actually authenticated.

Billing services may be incorporated within the authentication processitself, by, for example, categorizing each name lookup as a particularbilling event at the same time a response is formed. Or billing servicesmay be determined via log analysis on a periodic basis by categorizingeach logged query ex post.

Other embodiments of the disclosure will be apparent to those skilled inthe art from consideration of the specification and practice of theembodiments disclosed herein. In particular, it should be appreciatedthat the processes defined herein are merely exemplary, and that thesteps of the processes need not necessarily be performed in the orderpresented. It is intended that the specification and examples beconsidered as exemplary only, with a true scope and spirit of theembodiments being indicated by the following claims.

What is claimed is:
 1. A method for authenticating a DNS request,comprising: receiving at an authenticating server comprising anelectronic processor a DNS resolution request including a domain nameand authentication information, wherein the information is not in thedomain name, and wherein the authentication information comprises atleast one of a username/password combination, or a security certificate;validating, on the authenticating server comprising an electronicprocessor, the authentication information; determining, by theauthenticating server comprising an electronic processor, a DNS actionbased on the validation of the authentication information, wherein theDNS action comprises at least one of: sending a response message with anIP address, network layer identifier, or service location identifier;delaying sending a response message; sending a response message with anIP address corresponding to a website address containing authenticationinstructions; or responding with an alternative IP address correspondingto a special version of a resource configured to look just like theresource; and executing, on the authenticating server comprising anelectronic processor, the DNS action.
 2. The method of claim 1, whereinauthentication information is added to the DNS resolution request by adevice other than a device that originates the DNS resolution request.3. The method of claim 1, wherein the DNS resolution request furtherincludes one or more of: a source network layer address, an encrypteddata package, or hardware identification information.
 4. The method ofclaim 1, comprising: receiving, at the authenticating server,authentication information from a resource server for a particular user;and updating the authenticating server to store the authenticationinformation.
 5. The method of claim 1, wherein the IP address, networklayer identifier, or service location identifier corresponds to aone-time-use address.
 6. The method of claim 1, wherein the IP address,network layer identifier, or service location identifier corresponds toan address assigned to a particular user.
 7. The method of claim 1,wherein delaying sending a message comprises: determining that a DNSrequest was received from a particular user previously; determining thata DNS response was delayed for a first time period; and delaying sendinga message by a second time period, wherein the second time period isgreater than the first time period.
 8. The method of claim 1,comprising: determining a prioritized list of classes of users, whereinhigher priority classes receive access to services first or a higherquality of services; and classifying a user based on the authenticationinformation into a class in the prioritized list of classes, wherein theDNS action comprises: sending a response message with an IP addresscorresponding to a server delivering a particular class.
 9. The methodof claim 1, comprising: determining a billing event based on thevalidation of the authentication information, and billing a client basedon the billing event.
 10. A system for authenticating a DNS request,comprising: an authenticating server comprising: a processor; andmemory, wherein the memory contains instructions, which, when executedby the processor, perform a method comprising: receiving at anauthenticating server a DNS resolution request including a domain nameand authentication information, wherein the information is not in thedomain name, and wherein the authentication information comprises atleast one of a username/password combination, or a security certificate;validating, on the authenticating server, the authenticationinformation; determining, by the authenticating server, a DNS actionbased on the validation of the authentication information, wherein theDNS action comprises at least one of: sending a response message with anIP address, a network layer address or service location address,delaying sending a response message, sending a response message with anIP address corresponding to a website address containing authenticationinstructions, or responding with an alternative IP address correspondingto a special version of a resource configured to look just like theresource; and executing, on the authenticating server, the DNS action.11. The system of claim 10, wherein authentication information is addedto the DNS resolution request by a device other than a device thatoriginates the DNS resolution request.
 12. The system of claim 10,wherein the DNS resolution request further includes one or more of: asource network layer address, an encrypted data package, or hardwareidentification information.
 13. The system of claim 10, wherein themethod comprises: receiving, at the authenticating server,authentication information from a resource server for a particular user;and updating the authenticating server to store the authenticationinformation.
 14. The system of claim 10, wherein the IP address, thenetwork layer address or service location address corresponds to aone-time-use address.
 15. The system of claim 10, wherein the IPaddress, the network layer address or service location addresscorresponds to an individualized address assigned to a particular user.16. The system of claim 10, wherein delaying sending a messagecomprises: determining that a DNS request was received from a particularuser previously; determining that a DNS response was delayed for a firsttime period; and delaying sending a message by a second time period,wherein the second time period is greater than the first time period.17. The system of claim 10, wherein the method comprises: determining aprioritized list of classes of users, wherein higher priority classesreceive access to services first or a higher quality of services; andclassifying a user based on the authentication information into a classin the prioritized list of classes, wherein the DNS action comprises:sending a response message with an IP address corresponding to a serverdelivering a particular class.
 18. The system of claim 10, wherein themethod comprises: determining a billing event based on the validation ofthe authentication information, and billing a client based on thebilling event.
 19. Non-transitory computer-readable media containinginstructions, which, when executed by a processor, perform a methodcomprising: determining a prioritized list of classes of users, whereinhigher priority classes receive access to services first or a higherquality of services; classifying a user based on the authenticationinformation into a class in the prioritized list of classes; receivingat an authenticating server a DNS resolution request includingauthentication information, wherein the authentication informationcomprises at least one of a username/password combination, or a securitycertificate; validating, on the authenticating server, theauthentication information; determining, by the authenticating server, aDNS action based on the validation of the authentication information,wherein the DNS action comprises at least one of: sending a responsemessage with an IP address, a network layer address or service locationaddress, delaying sending a response message, sending a response messagewith an IP address corresponding to a website address containingauthentication instructions, and responding with an alternative IPaddress corresponding to a special version of a resource configured tolook just like the resource; and executing, on the authenticatingserver, the DNS action.
 20. The non-transitory computer-readable mediaof claim 19, wherein authentication information is added to the DNSresolution request by a device other than a device that originates theDNS resolution request.
 21. The non-transitory computer-readable mediaof claim 19, wherein the DNS resolution request further includes one ormore of: a source network layer address, a username/passwordcombination, an encrypted data package, a security certificate, orhardware identification information.
 22. The non-transitorycomputer-readable media of claim 19, wherein the method comprises:receiving, at the authenticating server, authentication information froma resource server for a particular user; and updating the authenticatingserver to store the authentication information.
 23. The non-transitorycomputer-readable media of claim 19, wherein the IP address, the networklayer address or the service location address comprises anindividualized network layer address or service location addresscorresponding to a one-time-use address.
 24. The non-transitorycomputer-readable media of claim 19, wherein the IP address, the networklayer address or the service location address comprises anindividualized network layer address or service location addresscorresponding to an address assigned to a particular user.
 25. Thenon-transitory computer-readable media of claim 19, wherein delayingsending a message comprises: determining that a DNS request was receivedfrom a particular user previously; determining that a DNS response wasdelayed for a first time period; and delaying sending a message by asecond time period, wherein the second time period is greater than thefirst time period.
 26. The non-transitory computer-readable media ofclaim 19, wherein the DNS action comprises: sending a response messagewith an IP address corresponding to a server delivering a particularclass.
 27. The non-transitory computer-readable media of claim 19,wherein the method comprises: determining a billing event based on thevalidation of the authentication information, and billing a client basedon the billing event.
 28. A method for authenticating a DNS request,comprising: receiving, at an authenticating server comprising anelectronic processor, a DNS resolution request from a user, wherein therequest includes a domain name to be resolved and an authenticationcertificate, wherein the authentication certificate was issued by acommunity authority trust in response to a request for identificationauthentication by the user, and wherein authentication certificate wasadded to the DNS resolution request by a device other than a device thatoriginates the DNS resolution request; validating, on the authenticatingserver comprising an electronic processor, the authenticationcertificate; determining, by the authenticating server comprising anelectronic processor, a network layer address or service locationaddress based on the validation of the authentication certificate; andsending the network layer address to the user.
 29. The method of claim28, wherein the authentication certificate indicates the authenticationof a group of users.
 30. The method of claim 28, wherein the DNSresolution request also includes certificate authority credentials ofthe community authority trust.
 31. The method of claim 28, wherein theauthentication certificate contains permission data corresponding to theDNS resolution request.
 32. The method of claim 31, wherein the DNSaction comprises: determining the network layer address or servicelocation address corresponding to the DNS resolution request based onthe permission data; and sending a signal to a resource server, whereinthe signal causes the resource server to provision the network layeraddress or service location address.